DigitalOcean Droplet上Ghost子目录部署遇403错误求助

我在DigitalOcean购买了6美元的Ghost Droplet，现有主站jointero.org，希望将Ghost部署在/blog子目录中。已配置Ghost的url为https://www.jointero.org/blog，并在Web服务器的Nginx中设置/blog路径反向代理至Droplet的IP，但访问时出现403 Forbidden错误。尝试多种网上方法无效，附上相关配置及错误日志寻求帮助。

Nginx sites-enabled配置 #

server {
  server_name jointero.org www.jointero.org;
  location / {
    proxy_pass http://localhost:8080;
  }

location /blog {
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_http_version 1.1;
    proxy_set_header Update &http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
    proxy_pass http://137.184.139.240/;
  }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/jointero.org/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/jointero.org/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


}

server{
    if ($host = www.jointero.org) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


  if ($host = jointero.org) {
    return 301 https://$host$request_uri;
  } # managed by Certbot
  server_name jointero.org www.jointero.org;
  listen 80;
  return 404; # managed by Certbot


}

Ghost配置 #

{
  "url": "http://www.jointero.org/blog/",
  "server": {
    "port": 2368,
    "host": "127.0.0.1"
  },
  "database": {
    "client": "mysql",
    "connection": {
      "host": "localhost",
      "user": "hidden",
      "password": "hidden",
      "port": 3306,
      "database": "hidden"
    }
  },
  "mail": {
    "transport": "Direct"
  },
  "logging": {
    "transports": [
      "file",
      "stdout"
    ]
  },
  "process": "systemd",
  "paths": {
    "contentPath": "/var/www/ghost/content"
    }
 }

Nginx错误日志 #

directory index of "/var/www/ghost/system/nginx-root/" is forbidden, client: 45.132.240.139, server: www.jointero.org, request: "GET // HTTP/1.1", host: "jointero.org" 

问题分析与修复步骤 #

1. 修正Nginx反向代理路径 #

当前location /blog中的proxy_pass末尾加了斜杠，导致请求/blog时被转发到Ghost服务器的根路径/，和Ghost配置的/blog路由不匹配，还会引发路径拼接错误（日志中的GET // HTTP/1.1就是证据）。

修复：
将proxy_pass末尾的斜杠去掉，改为：

proxy_pass http://137.184.139.240;

2. 修正Ghost的URL协议和格式 #

Ghost配置里的url用了http，但实际站点是https，会导致资源路径生成错误；同时末尾的斜杠也可能引发路由问题。

修复：
修改Ghost配置文件中的url字段：

"url": "https://www.jointero.org/blog"

3. 修正Nginx的Upgrade头部拼写错误 #

配置里的proxy_set_header Update &http_upgrade;是错误的，正确的WebSocket升级头部应为Upgrade，拼写错误会导致连接异常。

修复：
替换为：

proxy_set_header Upgrade $http_upgrade;

4. 重启服务生效 #

修改配置后，重启Nginx和Ghost服务：

sudo systemctl restart nginx
sudo systemctl restart ghost_jointero-org

内容的提问来源于stack exchange，提问作者Adeel Faridi